SECURITY BUG: Unauthenticated access to full unit calendar data, including when public calendar display and ICS are turned off

TroopTrack Bugs
1

Priority: High. This affects every unit that uses the TroopTrack calendar, not just ours, and the data involved is where and when children meet. For a platform serving Scout units, that is a youth-safety exposure, not a cosmetic bug.

Fellow unit admins, and TroopTrack team,

I am posting this publicly because it affects every unit. The full technical details, including how to reproduce it against a live unit, are in a confidential support ticket I have filed with TroopTrack Support today, October 26. The system did not give me any confirmation or ticket number, just “Thank you for reaching out ot us!” (spelling as written), so I can only hope the developers pick it up. I am deliberately not describing the mechanism here, because posting it would expose every unit to the risk, whether they read this or not, including mine.

What I can say: our unit found that our complete calendar, event titles, times, locations, and full descriptions, could be read without any login. We closed the paths we control. We turned off our public calendar page and revoked and replaced our calendar subscription URL. One path remains open, it is not controlled by any setting available to a unit admin, and only TroopTrack can close it. Our descriptions, like many units’, include contact emails and meeting links. The calendar also shows where and when groups of children meet, down to individual dens.

This is not only our unit. Using a check that retrieved no event data, we confirmed the same open path on six of the nine unit sites we sampled. And it should not take a sophisticated setup to be safe: a unit should not need its own website, a domain override, or a second software stack in front of TroopTrack to keep its calendar private. The default setup should keep children safe as delivered.

Until TroopTrack confirms a fix, three steps are worth taking on your own unit:

  1. Consider turning off “Display your calendar on your public website?” in your website settings. This does not fix the problem, but it reduces the casual exposure to it.
  2. Rotate your calendar subscription URL, and treat the new one as a secret. Or disable it entirely. Anyone holding it can read your calendar without logging in, whatever the surrounding wording suggests.
  3. Check what your own public pages show when you are logged out. That is how we found this.

TroopTrack team: please acknowledge the ticket here so other units know it is being worked, and treat it as a youth-safety priority. Many of your customers are Scout units serving children ages 5 to 10. A calendar that publishes where children gather should require a login.

I will update this thread when Support confirms a fix. Until then, consider it open. If you are a unit admin who finds the same exposure on your site, please add your unit to the ticket, but do not add technical details or methods here. If you have technical details to add, submit a private support ticket and reference this thread.

James Mortimer
Committee Chair, Cub Scout Pack 137, Cranford, NJ

2

Are you saying that with the public calendar option disabled and the ICS token revoked you were still able to discover the public ICS URL? You can message me directly if it would require divulging the method. I have alerted TT admin on my back channel as well.

3

Thanks for asking, and for alerting the admins. Not exactly: it is a different mechanism. The ICS leak was closed by revoking the token. This other mechanism remains open even with the public calendar display off. I explained it in the private support ticket, and I will send you the details by PM, not here.

4

Support posted it to our back end chat for the Admin who assigns tasks to the Developer. I see now what you are saying. If I don’t hear anything from the Admin today I will message him directly to raise the priority level.